Deprovisioning tasks

Use Deprovisioning tasks to ensure that employees lose access to all business applications when they leave your company.

Overview

Offboarding workflows can include Deprovisioning task to notify a task assignee to delete an account/deprovision access to an application for the offboarded employee.

Blissfully will also treat completed Deprovisioning tasks as another data source as to confirm that an employee not longer has access to an application. Blissfully will update the applications' user list and remove the offboarded person accordingly as well as remove the application from the offboardee's application list.

How Deprovisioning tasks get created

Deprovisioning tasks do not need to be manually added to a team's offboarding plan. When you draft an offboarding workflow, Blissfully will automatically create deprovisioning tasks for two sets of applications:

  1. Team apps - All required apps that have been assigned to the offboardee's teams

  2. Other accessed apps - All other apps that Blissfully has identified that the offboardee has accessed

All Deprovisioning tasks in a offboarding workflow will automatically have a default "Start after" date set to the employee's last date/time of employment. Task assignees won't be notified to deprovision access for applications until after the employee had departed.

Deprovisioning tasks for team apps

During offboarding, Blissfully will create deprovisioning tasks for "Required" applications assigned to the teams for which the offboardee is a member. For example, if you are offboarding an employee who is a member of the "Engineering" and "All Employees" teams, deprovisioning tasks will created by default for all apps that are set as "Provisioning Required" for those two teams.

App that are not set as "Provisioning Required" or that are noted as "Optional" will not automatically have a deprovisioning task created unless Blissfully has identified that the employee has accessed that application.

Deprovisioning tasks for other accessed apps

To ensure that all accounts are closed and no company data is incorrectly exposed, Blissfully will also create Deprovisioning tasks for other non-team apps for which Blissfully has identified for that offboardee has accessed. For example, if an employee has signs up for an unauthorized test Zapier account using their G Suite SSO, Blissfully will create a deprovisioning task for Zapier for that employee's offboarding workflow.

How Deprovisioning tasks get assigned

As Deprovisioning tasks are automatically created for an employee's offboarding as opposed to being manually added and edited for a team's offboarding plan, Blissfully will automatically assign a task assignee.

Blissfully will automatically assigns the task assignee based on the following priority list subject to availability.

  1. Provisioning task assignee in Onboarding plan (only for Team apps)

  2. App IT Admin

  3. App Owner

  4. Team Lead (only for Team apps)

  5. IT Lead

  6. Workflow Initiator

Scenario 1: Zapier is a Team app

In a slightly different example, if Zapier was assigned the Operations team that the offboardee was a member of, Blissfully would:

  • First assign the Deprovisioning task to mirror the same task assignees as set on the Zapier Provisioning task on the Operation team's onboarding plan

  • If there isn't a provisioning task assignee to mirror, assign the task to the App IT Admin for Zapier

  • If the IT Admin was also not set, then Blissfully would assign the task to the App Owner set for Zapier

  • If the App Owner for Zapier was not set then Blissfully assign the task to the Team Lead set for the Operations team

  • If the Team Lead for the Operations team was not set then Blissfully assign the task to the IT Lead

  • If the IT Lead was also not set, Blissfully would default to the final role and assign the task to the user who launched the onboarding workflow (the Workflow Initiator)

Scenario 2: Zapier is not a Team app

In our Zapier example, if Zapier was not assigned to any team that the offboardee was a member of, Blissfully would:

  • First assign the task to the App IT Admin for Zapier

  • If the IT Admin was also not set, then Blissfully would assign the task to the App Owner set for Zapier

  • If the App Owner for Zapier was not set then Blissfully assign the task to the IT Lead

  • If the IT Lead was also not set, Blissfully would default to the final role and assign the task to the user who launched the onboarding workflow (the Workflow Initiator)

Blissfully's default assignee for Deprovisioning tasks during offboarding is to mirror the assignee on a team's onboarding plan!